Tightened icon frame bounds validation to treat `ImageOffset == available` as invalid, preventing non-empty resources from starting at the exclusive end of the icon stream. Added a regression test that mutates an ICO directory entry to this boundary value and verifies both `Decode` and `Identify` throw `InvalidImageContentException` with the expected message.